Facebook has been ordered to pay a $9 million penalty after the Competition Bureau found the company made false or misleading claims about the privacy of Canadians’ personal information.

The penalty is part of a settlement released Tuesday (May 19) where Facebook agreed to not make false or misleading representations about how users’ personal information posted on Facebook and Messenger is used. The agreement comes after the probe, which looked at Facebook’s practices between August 2012 and June 2018.

The investigation found that Facebook gave the impression that users could control who could see their personal information by changing their account’s privacy settings, even though this did not fully ensure privacy.

“Facebook did not limit the sharing of users’ personal information with some third-party developers in a way that was consistent with the company’s privacy claims,” the Competition Bureau statement said. “This personal information included content users posted on Facebook, messages users exchanged on Messenger, and other information about identifiable users.”

The bureau found that Facebook allowed third-party developers to gain information on the friends of users who installed certain applications, even years after the company said it would stop the practice. According to the bureau, Facebook claimed it would stop after April 30, 2015, but the practice continued until 2018.

In a statement, a Facebook company spokesperson said the social media site did not agree with the result of the probe. However, the company said it would not contest the conclusions.

“We will build on the improvements we’ve made in protecting people’s information and how we communicate about the privacy controls Canadians can use,” the spokesperson said.

The social media company will also have to pay $500,000 to cover the costs of the investigation.